Analysis
-
max time kernel
128s -
max time network
151s -
resource
win10v191014
Task
task1
Sample
VBS_ed167804673b6f89dc6657e71ae971c4.14.zip
Resource
win7v191014
0 signatures
Task
task2
Sample
VBS_ed167804673b6f89dc6657e71ae971c4.14.zip
Resource
win10v191014
0 signatures
Task
task3
Sample
document4753.vbe.vbs
Resource
win7v191014
0 signatures
Task
task4
Sample
document4753.vbe.vbs
Resource
win10v191014
0 signatures
General
-
Target
VBS_ed167804673b6f89dc6657e71ae971c4.14
-
Sample
191122-jbllvf7p1n
-
SHA256
3e605855ed4bbc789477d2feddce2781b56d195311e17f753fc65d709b1f2321
Score
N/A
Malware Config
Signatures
-
Drops file in system dir 5 IoCs
description ioc pid Process File opened for modification C:\Windows\Debug\ESE.TXT 3976 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 3976 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 3976 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 3976 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 3976 svchost.exe -
Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
description ioc pid Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 3696 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 3696 svchost.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" 4172 svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" 4172 svchost.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4996 wrote to memory of 5064 4996 WScript.exe 72 PID 5064 wrote to memory of 4104 5064 wscript.exe 73 PID 4104 wrote to memory of 1540 4104 wscript.exe 74 PID 1540 wrote to memory of 1012 1540 wscript.exe 75 PID 1012 wrote to memory of 3708 1012 wscript.exe 76 PID 3708 wrote to memory of 4428 3708 wscript.exe 77 PID 4428 wrote to memory of 3620 4428 wscript.exe 78 PID 3620 wrote to memory of 4500 3620 wscript.exe 79 PID 4500 wrote to memory of 4652 4500 wscript.exe 80 PID 4652 wrote to memory of 4768 4652 wscript.exe 82 PID 4768 wrote to memory of 4392 4768 wscript.exe 83 PID 4392 wrote to memory of 3792 4392 wscript.exe 84 PID 3792 wrote to memory of 4244 3792 wscript.exe 85 PID 4244 wrote to memory of 4156 4244 wscript.exe 86 PID 4156 wrote to memory of 3940 4156 wscript.exe 87 PID 3940 wrote to memory of 4160 3940 wscript.exe 88 PID 4160 wrote to memory of 3840 4160 wscript.exe 89 PID 3840 wrote to memory of 4976 3840 wscript.exe 90 PID 4976 wrote to memory of 2720 4976 wscript.exe 91 PID 2720 wrote to memory of 784 2720 wscript.exe 92 PID 784 wrote to memory of 4616 784 wscript.exe 93 PID 4616 wrote to memory of 5020 4616 wscript.exe 94 PID 5020 wrote to memory of 5092 5020 wscript.exe 95 PID 5092 wrote to memory of 4280 5092 wscript.exe 96 PID 1964 wrote to memory of 1688 1964 SppExtComObj.exe 98
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:4996
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___-1⤵
- Suspicious use of WriteProcessMemory
PID:5064
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4104
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:1540
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:1012
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:3708
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4428
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:3620
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4500
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4652
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4768
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4392
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:3792
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4244
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4156
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:3940
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4160
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:3840
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4976
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:2720
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:784
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4616
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:5020
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:5092
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document4753.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵PID:4280
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1964
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:1688
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in system dir
PID:3976
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:4492
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵
- Checks system information in the registry (likely anti-VM)
PID:3696
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:4220
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵
- Windows security modification
PID:4172
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1089